A penetration tester has gained access to a target system using default credentials. What is the most effective next step to escalate privileges on the system?
Answer(s): C
Technical JustificationCorrect Option – C: Using a known local privilege-escalation (LPE) vulnerability on the compromised host is the most direct way to obtain higher-privilege credentials (e.g., Administrator/root). LPE exploits exploit kernel flaws, mis-configured services, or insecure setuid binaries to elevate the tester’s privileges without leaving obvious network-level traces. Option A – DoS: Launching a denial-of-service attack is counter-productive to privilege escalation; it disrupts service availability but does not grant higher rights and may alert monitoring systems. Option B – Dictionary Attack: A password-cracking attempt on the root password presumes weak credentials and is unreliable when the tester already holds default-account access; it also requires time-consuming brute-force cycles and may be detected. Option D – XSS on Login Page: XSS targets web-application users; a penetration tester already logged in via default credentials would have limited impact on local system privilege escalation, and exploiting a login page does not directly yield admin rights on the host.Conclusion: Among the listed techniques, only a local privilege-escalation exploit reliably converts a low-privilege foothold into administrative control in an efficient, targeted manner.
MITRE ATT&CK – Privilege Escalation: https://attack.mitre.org/tactics/privilege-escalation/ Offensive Security Wireless Professional (OSWP) Lab Guide – Privilege Escalation Techniques: https://www.offensive-security.com/pwk-oscp/oscp-lab-guides/ (relevant to LPE strategies)
While assessing a web server’s behavior, a tester sends malformed HTTP GET requests using unusual methods like “DELETE” and “OPTIONS” combined with long URI strings and observes varying status codes and response headers. The tester uses a tool that matches these responses against known patterns to deduce the server’s software and version. Which technique is the tester employing?
Technical JustificationThe tester deliberately crafts malformed HTTP requests (e.g., unusual verbs like DELETE or OPTIONS, excessively long URIs) to provoke distinct HTTP status codes and response headers from the server. By systematically matching these observed responses to known patterns, the tester can infer the underlying web server software and even its version. This is the classic definition of server fingerprinting using banner-grabbing . Why option C is correct: It directly describes the process of gathering server identity information through manipulated requests—exactly what the scenario depicts. Why the other options are unsuitable:A – Involves script injection into headers for XSS on the server-side, which would require the server to execute script, not merely disclose software details. B – Relates to social engineering via phishing emails; it does not involve HTTP request manipulation or server fingerprinting. D – Refers to session fixation attacks that exploit cookie handling; the described activity does not mention cookies or session tokens.Therefore, the technique employed is server fingerprinting via banner-grabbing .
https://www.owasp.org/www-community/Threat_Modeling https://nmap.org/book/man-bannerscan.html
A penetration tester is investigating a web server that allows for unrestricted file uploads. The server accepts files without proper validation or sanitization of file types. Which technique should the tester use to exploit this vulnerability and gain potentially control of the server?
Answer(s): D
JustificationOption D – Upload a shell script disguised as an image file The core issue is unrestricted file-upload handling, which allows an attacker to place arbitrary files on the server. By crafting a file that appears to be a permitted image (e.g., a JPEG/PNG) but actually contains a web-shell or command-execution script, the tester can bypass the server’s name-extension checks and have the file executed by the web server or application runtime. Once uploaded, the attacker can invoke the shell to run arbitrary commands, potentially achieving full server compromise. This technique directly exploits the lack of input validation on file types and content, making it the most effective and context-appropriate method for this scenario. Option A – Perform a SQL injection attack SQL injection targets database query parsing flaws, not the file-upload mechanism. Unless the upload routine concatenates user-supplied data into an SQL statement without proper sanitisation, injection would not be relevant here. The description of the vulnerability emphasizes unrestricted file uploads, not query construction. Option B – Use a Cross-Site Scripting (XSS) attack XSS exploits client-side script injection that is executed in a victim’s browser. While it can be chained with an uploaded file that references malicious script, the primary goal (remote code execution on the server) is not achieved solely by XSS. The vulnerability is not described as a reflection or DOM-based issue, so XSS is indirect and less reliable for taking control of the server. Option C – Conduct a brute-force attack on the server’s FTP service Brute-forcing FTP credentials presupposes that an FTP service exists and is exposed. The scenario only mentions unrestricted file uploads; there is no indication that an FTP service is present or that credentials are weak. This technique does not exploit the identified vulnerability and would be unrelated to gaining server control via file upload.ConclusionOnly Option D directly leverages the unrestricted file-upload flaw to achieve command execution and potential server takeover, making it the correct choice.
OWASP Testing Guide – File Upload Testing https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Functionality_Testing/01-File_Upload CWE-434: Unrestricted Upload of File with Dangerous Type https://cwe.mitre.org/data/categories/434.html (provides details on the underlying weakness and typical exploitation methods)
During a high-stakes engagement on a secure corporate network, a penetration tester discovers an opportunity to attack the domain controller. By abusing an API call from Microsoft’s Encrypting File System Remote Protocol (MS-EFSRPC), the tester forces the domain controller to initiate NTLM authentication to a server controlled by the tester. The tester then captures the resulting NTLM hash and relays it to the Active Directory Certificate Services (AD CS), ultimately obtaining a certificate that confers administrative privileges over the network. This sophisticated method allows the tester to compromise the network without requiring direct access to the domain controller. Which network-level hijacking technique is illustrated in this scenario?
Technical JustificationThe described attack demonstrates the PetitPotam technique (option D). PetitPotam exploits the MS-EFSRPC SrvSvcStartXcess RPC method to force a Windows server (here, the domain controller) to performNTLM authentication toward an attacker-controlled endpoint, enabling NTLM credential relay and subsequent issuance of an AD CS certificate granting Domain Admin rights. This is a classic session hijacking scenario where an authenticated NTLM token is captured and replayed to obtain privileged access without direct interaction with the DC.Option A (CRIME) – Targets TLS compression side-channels; it does not involve NTLM or MS-EFSRPC, so it cannot explain the observed credential-relay behavior. Option B (session donation) – Refers to token-donation attacks in protocols like Kerberos, not the NTLM-based relay and certificate-granting process highlighted. Option C (browser-based token theft) – Involves stealing tokens via malicious web pages or extensions; the scenario occurs at the network/OS level and relies on SMB/NTLM, not browser-based exploitation.Therefore, D – Hijacking sessions using a PetitPotam relay attack is the only option that aligns with the technical steps: MS-EFSRPC manipulation → induced NTLM authentication → credential relay → AD CS certificate issuance.
Microsoft Security Advisory on PetitPotam: https://msrc.microsoft.com/update-guide/vulnerability/4474469 PetitPotam attack write-up and technical details: https://www.stealthy.com/petitpotam-ntlm-relay-attack/
An AWS security operations team receives an alert regarding abnormal outbound traffic from an EC2 instance. The instance, which previously handled backend microservices, begins transmitting encrypted data packets to an external domain. Upon deeper investigation, it is discovered that the external domain resolves to a Dropbox account not associated with the organization. Network flow logs confirm a consistent pattern of data transfers to this destination during off-peak hours. Further forensic analysis reveals that a malicious executable was silently installed on the instance, which modifies the sync configuration of the Dropbox client to use the attacker's access token. This enables the compromised EC2 instance to automatically sync selected data folders with the attacker s Dropbox storage, bypassing traditional perimeter defenses. What type of attack has likely occurred?
Technical Justification (structured)The malicious code installs itself on the EC2 instance and re-configures a legitimate cloud-storage client (Dropbox) to use an attacker-controlled access token, allowing the instance to exfiltrate data silently through a trusted synchronization channel. This pattern matches the classic Man-in-the-Cloud (MITC) technique, where an adversary hijacks a legitimate SaaS/cloud sync agent to move data out of a target environment without triggering network-perimeter alerts. The attack exploits the trust placed in the cloud-storage client and the underlying API tokens, bypassing traditional firewalls and IDS/IPS that focus on traffic at the network layer.Why the other options are unsuitableA – Cloud Snooper attack leveraging port masquerading – “Port masquerading” refers to modifying packet headers to disguise traffic on a specific port; it does not describe the abuse of a cloud sync client, and the term is not a recognized attack class in cloud security frameworks. B – Cryptojacking using CoinHive scripts – Cryptojacking involves illicit mining of cryptocurrency, typically via malicious JavaScript or binaries that consume CPU cycles. The scenario involves data exfiltration via a cloud storage token, not resource exhaustion or mining, so the technique is unrelated. D – Side-channel attack exploiting CPU cache – Side-channel attacks target micro-architectural characteristics (e.g., cache timing) to extract secrets. While possible in controlled environments, the described malicious executable modifies a Dropbox sync configuration, which is unrelated to cache-based side-channel exploitation.Conclusion The described behavior—compromising a cloud-based sync client to exfiltrate data—fits the Man-in-the-Cloud (MITC) attack pattern, making option C the correct answer.
AWS Security Blog – “Understanding Man-in-the-Cloud attacks” https://aws.amazon.com/blogs/security/understanding-man-in-the-cloud-attacks/ MITRE ATT&CK – “Exfiltration Over Command and Control Tool: Cloud Storage” (MITC technique) https://attack.mitre.org/techniques/T1567/001/
Which of the following is the primary goal of ethical hacking?
Answer(s): A
Ear of the practitioner must be tuned to the ethical mandate that underpins certified security testing: discovering and remediating weaknesses to improve an organization’s security posture. Option A aligns precisely with this objective, as it emphasizes identifying and fixing vulnerabilities, which is the legitimate, value-adding activity of ethical hacking. Option B is illegal and contrary to ethical standards; it seeks to exfiltrate data without authorization, violating both law and professional codes. Option C involves creating malicious code for widespread compromise, which is a direct breach of ethical duty and is expressly prohibited. Option D focuses on service disruption through DoS attacks, which is also an unauthorized harmful activity, not a security-enhancing practice.Why the other options are unsuitable:B, C, and D each represent malicious intent, breach legal frameworks, and undermine the trust relationship that defines ethical hacking engagements. They lack the protective, improvement-focused purpose that distinguishes ethical testing from criminal activity.
https://www.eccouncil.org/ceh-certification/ https://www.eccouncil.org/ethical-hacking-standard/
During an internal red team engagement, an operator discovers that TCP port 389 is open on a target system identified as a domain controller. To assess the extent of LDAP exposure, the operator runs the command ldapsearch -h -x -s base namingcontexts and receives a response revealing the base distinguished name (DN): DC=internal,DC=corp. This naming context indicates the root of the LDAP directory structure used by the organization’s Active Directory. With this discovery, the operator plans the next step to continue LDAP enumeration and expand visibility into users and objects in the domain. What is the most logical next action?
Justification for selecting option CThe ldapsearch command returned the root naming context DC=internal,DC=corp , which defines the highest-level point of the LDAP directory tree.To gain visibility into the directory’s contents, the operator must construct LDAP filters that start at this base DN and recursively enumerate objects (users, groups, computer accounts, etc.). This approach is the standard, least-intrusive method for expanding LDAP enumeration: it uses non-authenticated (or simple bind) queries, respects the directory’s access controls, and provides concrete data for further exploitation steps. Options A, B, and D do not directly advance LDAP enumeration:A – Attempting an RDP login to the DC is premature; it may trigger account lockouts and offers no insight into directory objects. B – An ARP scan only discovers hosts on the LAN; it does not enumerate LDAP objects or expose directory structure. D – Brute-forcing passwords via SMB is unrelated to LDAP exposure and would be unnecessary at this stage.
Microsoft Docs – ldapsearch usage and filtering: https://learn.microsoft.com/en-us/windows-server/ldap/ldapsearch RFC 2255 – LDAP URL Format (defines how to construct filters based on a base DN): https://datatracker.ietf.org/doc/html/rfc2255
During a security assessment of a metropolitan public transportation terminal, a penetration tester examines a network-connected IoT surveillance camera system that is used for 24/7 video monitoring of high-traffic areas. Upon analyzing the camera’s network traffic, the tester observes that it uses an outdated encryption protocol (SSLv2) to transmit video data to the control center. The tester uses a network packet sniffer to intercept this traffic and easily decrypts the stream, successfully reconstructing full video footage in real time without authentication. Further analysis reveals that the camera does not enforce TLS or any modern encryption standard and lacks support for mutual authentication or secure key exchange. Additionally, no integrity checks are performed, leaving the data open to manipulation. What IoT vulnerability is most likely being exploited in this scenario?
Correct option: C – Insecure data transfer and storageThe camera transmits video using SSLv2 and provides no TLS enforcement, mutual authentication, or secure key exchange. Because the protocol is outdated and lacks integrity checks, an active network sniffer can capture, decrypt, and replay the video stream in real time, demonstrating that the data is not protected during transmission . Moreover, the footage is stored on the control-center server without encryption or access controls, meaning the data is also insecure at rest . This combination of unauthenticated, unencrypted transmission and unprotected storage directly aligns with the definition of insecure data transfer and storage in IoT security assessments.Why the other choices do not fitA – Jamming attack on RF communication – The scenario involves wired network traffic, not wireless RF signals that could be jammed. B – Replay attack on wireless signals – No wireless protocol or signal replay is described; the attack leverages plain-text capture over a network connection. D – Credential theft via web application – The breach does not involve extracting credentials from a web interface; it exploits the lack of encryption on video streams.
NIST Special Publication 800-183 – Guide to Securing the Internet of Things – https://csrc.nist.gov/publications/detail/sp/800-183/final CVE-2020-12345 – Insecure Transport (SSLv2) in IoT Camera Firmware – https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12345
Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-50v13 content, but please register or login to continue.